Encrypted email provider ProtonMail was hit by a significant distributed denial-of-service (DDoS) attack that appears to have been carried out by a group linked to Russia.
ProtonMail informed customers on Wednesday morning that its network was targeted in a sustained attack. The organization said that while emails would be delayed, they were not lost as a result of the incident. Some users reported that the attack impacted the ProtonVPN VPN service as well.
Services were restored roughly three hours after the initial announcement was made.
“The attacks went on for several hours, although the outages were far more brief, usually several minutes at a time with the longest outage on the order of 10 minutes,” ProtonMail stated.
The company says it deals with DDoS attacks on a daily basis, but this attack was more significant and its DDoS protection provider, Radware, needed more time than usual to prepare mitigations.
“While we don’t yet have our own measurement of the attack size, we have traced the attack back to a group that claims to have ties to Russia, and the attack is said to have been 500 Gbps, which would be among the largest DDoS’s on record,” ProtonMail said in a post on Reddit.
The DDoS attack on ProtonMail may have been significant, but it does not compare to a recent attack that hit an unnamed U.S.-based service provider, which peaked at 1.7 Tbps.
A few hours after ProtonMail announced the attack, Germany-based secure email service provider Tutanota also informed users that it had been experiencing a DDoS attack, but it’s unclear if the incidents are related. Tutanota told customers that services had been restored roughly one hour later.
UPDATE. Radware told SecurityWeek that it believes the attackers are actually based in the UK, not Russia.
“We can’t confirm attack size as it varied at different points in the attack. However we can confirm that the attack was high volumetric, multi-vector attack. It included several UDP refection attacks, multiple TCP bursts, and Syn floods,” Radware said.
Related: You Can DDoS an Organization for Just $10 per Hour
Related: New DDoS Attack Method Obfuscates Source Port Data
Related: ProtonMail Launches VPN Application for macOS

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Google Patches Third Chrome Zero-Day of 2023
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
- Cybersecurity M&A Roundup: 36 Deals Announced in May 2023
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
Latest News
- KeePass Update Patches Vulnerability Exposing Master Password
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
